EUVD-2026-62599
GHSA-fg9p-mrxr-hvq7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Spec content is network-deliverable (AV:N) with no auth (PR:N), but a victim must run codegen and execute generated code (UI:R), and execution escapes Orval into the host/CI context (S:C) with full code execution (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.
AnalysisAI
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed executable JavaScript into generated client code. An unescaped backtick (and ${...} / backslash) in an OpenAPI path, server URL, or server-variable default is emitted verbatim into the template literals Orval generates for axios, fetch, react-query, and SWR clients, so attacker-controlled code runs whenever a generated request, URL-builder, or query-key function is invoked - inside the developer machine, CI pipeline, test suite, or running application. The upstream fix PR and security advisory include demonstrative injection payloads (e.g. require('child_process').execSync('id')), so working proof-of-concept exists, but there is no evidence of active exploitation (not in CISA KEV).
Technical ContextAI
Orval is a code generator that converts OpenAPI/Swagger specs into type-safe TypeScript HTTP clients. The root cause is CWE-94 (Improper Control of Generation of Code, 'Code Injection'): the route generator in packages/core/src/getters/route.ts interpolated spec-derived strings (path segments, servers[].url, and server variable defaults) directly into backtick-delimited JavaScript template literals in the emitted client. Because backticks, ${ interpolation sequences, and backslashes were not escaped, a value in the input spec could close the template literal and append arbitrary JavaScript that becomes part of the generated source. The query-key getter (packages/core/src/getters/keys.ts) had the analogous single-quote/backslash flaw. The 8.21.0 fix introduces a jsStringLiteralEscape helper (backed by the jsesc library) applied in both getters so spec text is safely encoded as string-literal content rather than live code.
RemediationAI
Vendor-released patch: upgrade Orval to 8.21.0 or later (https://github.com/orval-labs/orval/releases/tag/v8.21.0; fix in PR https://github.com/orval-labs/orval/pull/3692, commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6), which escapes spec-derived strings via jsStringLiteralEscape/jsesc before emitting them into template literals. Until you can upgrade, only run Orval against OpenAPI/Swagger specifications from fully trusted first-party sources and treat any externally supplied spec as untrusted code - review paths, servers[].url values, and server variable defaults for backticks, ${, or backslash sequences before generating; the trade-off is added manual review overhead. Additionally, run codegen and the generated test/build steps in a sandboxed or least-privilege CI runner so that any injected execution is contained, and regenerate/inspect all clients previously produced from third-party specs, since malicious code may already be baked into committed output.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
I analyzed the provided intelligence and produced the synthesis below. One thing to flag first: **⚠️ Prompt-injection n
External $ref resolution in Orval prior to version 8.22.0 allows server-side request forgery and path traversal against
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today